Commit graph

1,461,726 commits

Author SHA1 Message Date
Andreas Gruenbacher
0ec49e7ea6 gfs2: Introduce glock_{type,number,sbd} helpers
Introduce glock_type(), glock_number(), and glock_sbd() helpers for
accessing a glock's type, number, and super block pointer more easily.

Created with Coccinelle using the following semantic patch:

@@ struct gfs2_glock *gl; @@
- gl->gl_name.ln_type
+ glock_type(gl)

@@ struct gfs2_glock *gl; @@
- gl->gl_name.ln_number
+ glock_number(gl)

@@ struct gfs2_glock *gl; @@
- gl->gl_name.ln_sbd
+ glock_sbd(gl)

glock_sbd() is a macro because it is used with const as well as
non-const struct gfs2_glock * arguments.

Instances in macro definitions, particularly in tracepoint definitions,
replaced by hand.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26 14:28:18 +01:00
Andreas Gruenbacher
d3b39fcb39 gfs2: gfs2_glock_hold cleanup
Use lockref_get_not_dead() instead of an unguarded __lockref_is_dead()
check.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26 14:28:18 +01:00
Andreas Gruenbacher
536f48e8bb gfs: Use fixed GL_GLOCK_MIN_HOLD time
GL_GLOCK_MIN_HOLD represents the minimum time (in jiffies) that a glock
should be held before being eligible for release.  It is currently
defined as 10, meaning that the duration depends on the timer interrupt
frequency (CONFIG_HZ).  Change that time to a constant 10ms independent
of CONFIG_HZ.  On CONFIG_HZ=1000 systems, the value remains the same.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26 14:28:17 +01:00
Andreas Gruenbacher
c45fefe3a9 gfs2: Fix gfs2_log_get_bio argument type
Fix the type of gfs2_log_get_bio()'s op argument: callers pass in a
blk_opf_t value and the function passes that value on as a blk_opf_t
value, so the current argument type makes no sense.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26 14:28:17 +01:00
Andreas Gruenbacher
08ca56ffcd gfs2: gfs2_chain_bio start sector fix
Pass the start sector into gfs2_chain_bio(): the new bio isn't
necessarily contiguous with the previous one.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26 14:28:17 +01:00
Andreas Gruenbacher
4a94f052e0 gfs2: Initialize bio->bi_opf early
Pass the right blk_opf_t value to bio_alloc() so that ->bi_ops is
initialized correctly and doesn't have to be changed later.  Adjust the
call chain to pass that value through to where it is needed (and only
there).

Add a separate blk_opf_t argument to gfs2_chain_bio() instead of copying
the value from the previous bio.

Fixes: 8a157e0a0a ("gfs2: Fix use of bio_chain")
Reported-by: syzbot+f6539d4ce3f775aee0cc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26 14:28:17 +01:00
Andreas Gruenbacher
59d81037d3 gfs2: Rename gfs2_log_submit_{bio -> write}
Rename gfs2_log_submit_bio() to gfs2_log_submit_write(): this function
isn't used for submitting log reads.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26 14:28:17 +01:00
Andreas Gruenbacher
4928c36536 gfs2: Do not cancel internal demote requests
Trying to change the state of a glock may result in a "conversion
deadlock" error, indicating that the requested state transition would
cause a deadlock.  In this case, we unlock and retry the state change.
It makes no sense to try canceling those unlock requests, but the
current code is not aware of that.

In addition, if a locking request is canceled shortly after it is made,
the cancelation request can currently overtake the locking request.
This may result in deadlocks.

Fix both of these bugs by repurposing the GLF_PENDING_REPLY flag into a
GLF_MAY_CANCEL flag which is set only when the current locking request
can be canceled.  When trying to cancel a locking request in
gfs2_glock_dq(), wait for this flag to be set.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26 14:28:17 +01:00
Andreas Gruenbacher
5e3319932a gfs2: run_queue cleanup
In run_queue(), instead of always setting the GLF_LOCK flag, only set it
when the flag is actually needed.  This avoids having to undo the flag
setting later.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26 14:28:17 +01:00
Andreas Gruenbacher
11d763f0b0 gfs2: Retries missing in gfs2_{rename,exchange}
Fix a bug in gfs2's asynchronous glock handling for rename and exchange
operations.  The original async implementation from commit ad26967b9a
("gfs2: Use async glocks for rename") mentioned that retries were needed
but never implemented them, causing operations to fail with -ESTALE
instead of retrying on timeout.

Also makes the waiting interruptible.

In addition, the timeouts used were too high for situations in which
timing out is a rare but expected scenario.  Switch to shorter timeouts
with randomization and exponentional backoff.

Fixes: ad26967b9a ("gfs2: Use async glocks for rename")
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26 14:28:17 +01:00
Andreas Gruenbacher
f8f04248c7 gfs2: glock cancelation flag fix
When an asynchronous glock holder is dequeued that hasn't been granted
yet (HIF_HOLDER not set) and no dlm operation is in progress on behalf
of that holder (GLF_LOCK not set), the dequeuing takes place in
__gfs2_glock_dq().  There, we are not clearing the HIF_WAIT flag and
waking up waiters.  Fix that.

This bug prevents the same holder from being enqueued later (gfs2_glock_nq())
without first reinitializing it (gfs2_holder_reinit()).  The code
doesn't currently use this pattern, but this will change in the next
commit.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26 14:28:17 +01:00
Danilo Krummrich
559ac49154 Driver core fixes deferred from 6.19-rc7
[1, 2] were originally intended for -rc7. Patch [1] uncovered potential
 deadlocks that require a few driver fixes; [2] is one such fix.
 
 [1] https://patch.msgid.link/20260113162843.12712-1-hanguidong02@gmail.com
 [2] https://patch.msgid.link/20260121141215.29658-1-dakr@kernel.org
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCaXdn0AAKCRBFlHeO1qrK
 Lu0BAQDfaNgkqh55vA7C+meIUTKKEnARTsRHowRnex2zty0VVQEA/tExyJKy8QY4
 pNe8ghYW6mmad/eY+pixYzaFacv7+ws=
 =CzPS
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-6.19-rc7-deferred' into driver-core-next

Driver core fixes deferred from 6.19-rc7

[1, 2] were originally intended for -rc7. Patch [1] uncovered potential
deadlocks that require a few driver fixes; [2] is one such fix.

[1] https://patch.msgid.link/20260113162843.12712-1-hanguidong02@gmail.com
[2] https://patch.msgid.link/20260121141215.29658-1-dakr@kernel.org

Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-01-26 14:12:02 +01:00
Yi Liu
1956f0a74c RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
ib_uverbs_post_send() uses cmd.wqe_size from userspace without any
validation before passing it to kmalloc() and using the allocated
buffer as struct ib_uverbs_send_wr.

If a user provides a small wqe_size value (e.g., 1), kmalloc() will
succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge,
and other fields will read beyond the allocated buffer, resulting in
an out-of-bounds read from kernel heap memory. This could potentially
leak sensitive kernel information to userspace.

Additionally, providing an excessively large wqe_size can trigger a
WARNING in the memory allocation path, as reported by syzkaller.

This is inconsistent with ib_uverbs_unmarshall_recv() which properly
validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before
proceeding.

Add the same validation for ib_uverbs_post_send() to ensure wqe_size
is at least sizeof(struct ib_uverbs_send_wr).

Fixes: c3bea3d2dc ("RDMA/uverbs: Use the iterator for ib_uverbs_unmarshall_recv()")
Signed-off-by: Yi Liu <liuy22@mails.tsinghua.edu.cn>
Link: https://patch.msgid.link/20260122142900.2356276-2-liuy22@mails.tsinghua.edu.cn
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-01-26 07:57:44 -05:00
Niklas Cassel
5f64ae1ef6 ata: libata-core: Quirk INTEL SSDSC2KG480G8 max_sectors
Commit 9b8b84879d ("block: Increase BLK_DEF_MAX_SECTORS_CAP") increased
the default max_sectors_kb from 1280 KiB to 4096 KiB.

INTEL SSDSC2KG480G8 with FW rev XCV10120 times out when sending I/Os of
size 4096 KiB.

Enable ATA_QUIRK_MAX_SEC, with value 8191 (sectors) for this device,
since any I/O with more sectors than that lead to I/O timeouts.

With this, the INTEL SSDSC2KG480G8 is usable again.

Link: https://lore.kernel.org/linux-ide/176839089913.2398366.61500945766820256@eldamar.lan/
Fixes: 9b8b84879d ("block: Increase BLK_DEF_MAX_SECTORS_CAP")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-01-26 21:39:10 +09:00
Maíra Canal
68e28facbc
drm/panel: ilitek-ili9882t: Select DRM_DISPLAY_DSC_HELPER
The panel-ilitek-ili9882t driver uses drm_dsc_pps_payload_pack() which
is provided by the DRM_DISPLAY_DSC_HELPER. Add the missing Kconfig
select to fix the following build error:

  ERROR: modpost: "drm_dsc_pps_payload_pack" [drivers/gpu/drm/panel/panel-ilitek-ili9882t.ko] undefined!

Fixes: 65ce1f5834 ("drm/panel: ilitek-ili9882t: Switch Tianma TL121BVMS07 to DSC 120Hz mode")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Tested-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Reviewed-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Link: https://patch.msgid.link/20260115125136.64866-1-mcanal@igalia.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-01-26 09:38:44 -03:00
Danilo Krummrich
eb3dad518e Linux 6.19-rc7
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAml2lQweHHRvcnZhbGRz
 QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiG0dcH/2yLU3IKlHSSgEDL
 Qq3oBuRK/zoVOdy+CM+TmTdl2d1LnBd8J547xFStB7kVGf5mEkdFZdHLBSHRnKDf
 ia1SGec06kyLpRX6x5T6FsfwOhkBmVsp59X0coM57QWxxenybugtzPvDO2TQ8/G4
 buixJI0jJVgwRwXNzWB4n2W6FxNGui2A7gEN2mjtvkM2t/aDkiDjEqB8ve0pZJX9
 4EWhxOgRFzwWgkd/bY+4wgXVXEt3GtI+3VvNncRqLIO00A/AnZOYmH4S2RQUDszD
 IbyDscYYxloZcZMDXc3PN2WgD9DCGKuP3GpJGsOHbl0DN6JkqI9nwGsOFZKGVOeF
 vbajwPE=
 =iAOa
 -----END PGP SIGNATURE-----

Merge tag 'v6.19-rc7' into driver-core-next

We need the driver-core fixes in here as well to build on top of.

Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-01-26 13:23:52 +01:00
Shengjiu Wang
19b08fd23b
ASoC: fsl_sai: Add AUDMIX mode support on i.MX952
One of SAI interfaces is connected to AUDMIX in the i.MX952 chip, but
AUDMIX can be bypassed or not bypassed on the i.MX952 platform.

There are three use cases:
1) SAI -> Codec (No AUDMIX between SAI and Codec)
2) SAI -> Codec (Has AUDMIX, but AUDMIX is bypassed)
3) SAI -> AUDMIX -> Codec (Has AUDMIX and used)

So add 'fsl,sai-amix-mode' property for this feature

fsl,sai-amix-mode = "none": is for case 1)
fsl,sai-amix-mode = "bypass": is for case 2)
fsl,sai-amix-mode = "audmix": is for case 3)

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://patch.msgid.link/20260123082501.4050296-5-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 12:09:19 +00:00
Shengjiu Wang
291f2f9088
ASoC: fsl_audmix: Add support for i.MX952 platform
Add compatible string to support AUDMIX on i.MX952

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://patch.msgid.link/20260123082501.4050296-4-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 12:09:18 +00:00
Shengjiu Wang
4d3b56b8a3
ASoC: dt-bindings: fsl,sai: Add AUDMIX mode support on i.MX952
The SAI can connect to AUDMIX, but AUDMIX can be bypassed or not on
i.MX952. There are three use cases:

1) SAI -> Codec (No AUDMIX between SAI and Codec)
2) SAI -> Codec (Has AUDMIX, but AUDMIX is bypassed)
3) SAI -> AUDMIX -> Codec (Has AUDMIX and used)

So add 'fsl,sai-amix-mode' property for this feature

fsl,sai-amix-mode = "none": is for case 1)
fsl,sai-amix-mode = "bypass": is for case 2)
fsl,sai-amix-mode = "audmix": is for case 3)

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://patch.msgid.link/20260123082501.4050296-3-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 12:09:17 +00:00
Shengjiu Wang
7550d6263b
ASoC: dt-bindings: fsl,audmix: Add support for i.MX952 platform
Add a compatible string for i.MX952 platform.

There is a power domain on i.MX952 for the mix system of AUDMIX.
But it is enabled by default, AUDMIX device don't need to enable it,
so make the power-domains to be optional on i.MX952, and be required on
i.MX8QM.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260123082501.4050296-2-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 12:09:16 +00:00
Tvrtko Ursulin
12f15d52d3 drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
Since GEM bo handles are u32 in the uapi and the internal implementation
uses idr_alloc() which uses int ranges, passing a new handle larger than
INT_MAX trivially triggers a kernel warning:

idr_alloc():
...
	if (WARN_ON_ONCE(start < 0))
		return -EINVAL;
...

Fix it by rejecting new handles above INT_MAX and at the same time make
the end limit calculation more obvious by moving into int domain.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Reported-by: Zhi Wang <wangzhi@stu.xidian.edu.cn>
Fixes: 53096728b8 ("drm: Add DRM prime interface to reassign GEM handle")
Cc: David Francis <David.Francis@amd.com>
Cc: Felix Kuehling <felix.kuehling@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: <stable@vger.kernel.org> # v6.18+
Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260123141540.76540-1-tvrtko.ursulin@igalia.com
2026-01-26 11:45:51 +00:00
Kuninori Morimoto
af6d53db28
ASoC: soc-dapm: tidyup function naming
Current soc-dapm is using random naming. Unified as dapm_xxx() for
static functions.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87ecnlqgvn.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 11:44:47 +00:00
Kuninori Morimoto
5b517f1a5c
ASoC: soc-dapm: move struct snd_soc_dapm_context
All drivers are now using new dapm functions.
Move struct snd_soc_dapm_context to soc-dapm.c

Suggested-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://lore.kernel.org/r/87o6x69h4y.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87fr81qgvu.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 11:44:46 +00:00
Kuninori Morimoto
13c84b4c6f
ASoC: soc-dapm: add snd_soc_dapm_alloc()
Because struct snd_soc_dapm_context is soc-dapm framework specific, user
driver don't need to access its member directly, we would like to hide
them. struct snd_soc_dapm_context will be removed from header in the
future.

Current card/component are using dapm_context instance. But it will be
moved to soc-dapm.c, and we can use will be only pointer. Makes it to
pointer.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87h5shqgw1.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 11:44:45 +00:00
Kuninori Morimoto
cf0e8c555b
ASoC: soc-dapm: remove dev from snd_soc_dapm_context()
We can get dev via snd_soc_dapm_to_dev(). Remove it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87ikcxqgw9.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 11:44:44 +00:00
Kuninori Morimoto
40ff409eac
ASoC: soc-dapm: remove compatibility definition for dapm
All drivers uses new functions. Remove comaptibility definition.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87jyxdqgwk.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 11:44:43 +00:00
Kuninori Morimoto
d8b795f652
ASoC: soc-component: remove compatibility definition for component
All drivers uses new functions. Remove comaptibility definition.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87ldhtqgws.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 11:44:42 +00:00
Kuninori Morimoto
19a412b66d
ASoC: soc-component: remove snd_soc_component_xxx() wrapper
Now no one is using snd_soc_component_xxx() wrapper for dapm.
Remove it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87ms29qgx2.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 11:44:41 +00:00
Kuninori Morimoto
34a74d04cd
ASoC: tlv320adcx140: don't use snd_soc_component_get_bias_level()
snd_soc_component_get_bias_level() will be removed.
Let's use snd_soc_dapm_get_bias_level() instead.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87o6mpqgxc.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 11:44:40 +00:00
Guodong Xu
41399c5d47
regulator: spacemit-p1: Fix n_voltages for BUCK and LDO regulators
Higher voltage settings were unusable due to incorrect n_voltages values
causing registration failures. For example, setting aldo4 to 3.3V failed
with -EINVAL because the required selector (123) exceeded the allowed
range (n_voltages=117).

Fix by aligning n_voltages with the hardware register widths per the P1
datasheet [1]:
- BUCK: 255 (was 254), allows selectors 0-254, selector 255 is reserved
- LDO: 128 (was 117), allows selectors 0-127, selectors 0-10 are for
  suspend mode, valid operational range is 11-127

This enables the full voltage range supported by the hardware.

Fixes: 8b84d712ad ("regulator: spacemit: support SpacemiT P1 regulators")
Link: https://developer.spacemit.com/documentation [1]
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Link: https://patch.msgid.link/20260122-spacemit-p1-v1-1-309be27fbff9@riscstar.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 11:26:41 +00:00
Bard Liao
403a0591be
ASoC: soc-acpi-intel-ptl-match: fix name_prefix of rt1320-2
rt1320_2_group2_adr works with rt1320_1_group2_adr and the name_prefix
should be rt1320-2.

Fixes: ffe450cb6b ("ASoC: Intel: soc-acpi-intel-ptl-match: add rt713_vb_l3_rt1320_l12 support")
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20260123113809.2238766-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26 11:26:35 +00:00
Thorsten Blum
cb39cf99d8 m68k: sun3: Replace vsprintf() with bounded vsnprintf()
vsprintf() performs no bounds checking and can overflow - replace it
with the safer vsnprintf().

Also remove the useless '+ 1' that is a leftover of commit 66ed28ea09
("m68k: sun3: Remove unused vsprintf() return value in prom_printf()").

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://patch.msgid.link/20260117202152.1036278-2-thorsten.blum@linux.dev
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2026-01-26 12:26:01 +01:00
Finn Thain
f16a9577b7 nubus: Call put_device() in bus initialization error path
The error path for bus initialization is missing a call to put_device().
Add that call.  This error path will probably never actually execute,
but any kernel source code may be subject to static checking or re-use.

Cc: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Cc: Daniel Palmer <daniel@0x0f.com>
Suggested-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Finn Thain <fthain@linux-m68k.org>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://patch.msgid.link/478d5f080d74b6688c9e3f9132e3fe251e997ad7.1765610469.git.fthain@linux-m68k.org
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2026-01-26 12:26:01 +01:00
Greg Kroah-Hartman
a8a6d9b4da coresight: Updates for Linux v6.20/v7.0
This batch of CoreSight hwtracing updates contains :
  - Fine grained control of Timestamp generation in ETM4 trace, retaining backward
    compatibility
  - Feature updates for Qualcomm TPDA driver
  - Support Qualcomm Interconnect TNOC
  - Miscellaneous fixes to TMC-ETR driver
 
 Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuFy0byloRoXZHaWBxcXRZPKyBqEFAml3Q8UACgkQxcXRZPKy
 BqF8lg//UHXXwvZp2lKG8SwCPZoYBbwQSRwf7JMOXo/hEIF38qElWXm3zA7d0U4E
 qY+cKVaSTXxz5hrjTzkzDsLI2cLsmZX1R8QEhP33voXWPdW/b4GFA84WwKss/F7J
 2t4p/m/EbW/1305eIKkKqz5ev0J8vOe8FoPZ1oQ7h27Lw1EDw9wzpUCu9JZkljz3
 /A7c6i78H5fkF9ulRM+11/xZnZXnIIjdv3JRY2qrGUyvLXKs5dC59p9R6ln+cRWU
 1AOjCqMeCyjZPJAk/S6iH3Qi1R+NxN3tL4ojsmHnHojmql8mGKjCFbUkrw0eOgxg
 /3qFVIeIEmOq66Azj28yKezICpQwn9MyWxp03dVYGxPoCEpZP8x39NoK47inZD4u
 KXrKlLSQ6i0aehbjs0s2NsBsetHKHrkS16sXESvoPQSEb6KmgKk9PK9WSara3Plo
 ueJtuJzlSgLuxLciX6rnzrZALzhQWIsIpzNOaInWZMjJpNrramxk5T64tRwA9xhG
 eWErxaNLsJGCZzWA/4ozLgRUEBJygp6VpCNpU8ddjBMzMVaKyrk6W5vCfWlynwVy
 UNepYiAHqGYeV7JgbxfqAJHk4AazEWYNbkHhxZXd0PsRhqHTilDpfPtk3KFh2BVM
 k64vS0BnPWHvUYQSwghOkiHrSnqvtWWL9uqw/zZfSj+YMj6KP6E=
 =7lsU
 -----END PGP SIGNATURE-----

Merge tag 'coresight-next-v7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-next

Suzuki writes:

coresight: Updates for Linux v6.20/v7.0

This batch of CoreSight hwtracing updates contains :
 - Fine grained control of Timestamp generation in ETM4 trace, retaining backward
   compatibility
 - Feature updates for Qualcomm TPDA driver
 - Support Qualcomm Interconnect TNOC
 - Miscellaneous fixes to TMC-ETR driver

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

* tag 'coresight-next-v7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux: (27 commits)
  coresight: tmc: Decouple the perf buffer allocation from sysfs mode
  coresight: tmc-etr: Fix race condition between sysfs and perf mode
  coresight: tmc: Add missing doc including reading and etr_mode of struct tmc_drvdata
  coresight-tnoc: Add runtime PM support for Interconnect TNOC
  coresight-tnoc: add platform driver to support Interconnect TNOC
  dt-bindings: arm: qcom: Add Coresight Interconnect TNOC
  coresight: etm3x: Fix cpulocked warning on cpuhp
  coresight: tpda: Fix intendation for sysfs interface documentation
  coresight: tpda: add sysfs node to flush specific port
  coresight: tpda: add logic to configure TPDA_SYNCR register
  coresight: tpda: add global_flush_req sysfs node
  coresight: tpda: add sysfs nodes for tpda cross-trigger configuration
  coresight: docs: Document etm4x timestamp interval option
  coresight: Extend width of timestamp format attribute
  coresight: Prepare to allow setting the timestamp interval
  coresight: Remove misleading definitions
  coresight: Interpret ETMv4 config with ATTR_CFG_GET_FLD()
  coresight: Interpret perf config with ATTR_CFG_GET_FLD()
  coresight: Don't reject unrecognized ETMv3 format attributes
  coresight: Interpret ETMv3 config with ATTR_CFG_GET_FLD()
  ...
2026-01-26 12:11:11 +01:00
Greg Kroah-Hartman
dbd91d4f55 Merge 6.19-rc7 into char-misc-next
We need the char/misc/iio fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-26 12:04:04 +01:00
Jani Nikula
cca7eda1c7 drm/{i915, xe}/dsb: move DSB buffer to parent interface
Move the DSB buffer handling to the display parent interface, making
display more independent of i915 and xe driver implementations.

Since the DSB parent interface is only called from intel_dsb.c, add the
wrappers there with smaller visibility instead of the usual
intel_parent.[ch], and using struct intel_dsb as the context parameter
for convenience.

Unfortunately, memset() being a macro in linux/fortify-string.h, we
can't use that as the function pointer name. dsb->memset() would be
using the macro and leading to build failures. Therefore, use .fill()
for the memset() functionality.

v2: s/memset/fill/

Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
Link: https://patch.msgid.link/df117c862a6d34dae340e4a85c2482b4e29c8884.1768923917.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-01-26 11:56:41 +02:00
Jani Nikula
1617f5955c drm/i915/dsb: move i915 specific DSB buffer implementation to i915
The DSB buffer implementation is different for both i915 and xe. Move
the i915 specific implementation from display to i915 core.

Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
Link: https://patch.msgid.link/a01b3e69a3f79713eacf437af00dbe23d2f9c8dd.1768923917.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-01-26 11:56:41 +02:00
Jonathan Cavitt
ad3ebcc2d0 drm/i915/display: Prevent u64 underflow in intel_fbc_stolen_end
Static analysis reveals a potential integer underflow in
intel_fbc_stolen_end.  This can apparently occur if
intel_parent_stolen_area_size returns zero (or, theoretically, any value
less than 2^23), as 2^23 is subtracted from the return value and stored
in a u64.  While this doesn't appear to cause any issues due to the use
of the min() function to clamp the return values from the
intel_fbc_stolen_end function, it would be best practice to avoid
undeflowing values like this on principle.  So, rework the function to
prevent the underflow from occurring.  Note that the underflow at
present would result in the value of intel_fbc_cfb_base_max being
returned at the end of intel_fbc_stolen_end, so just return that if the
value of intel_parent_stolen_area_size is too small.

While we're here, fix the other comments here and modify the execution
path for readability.

v2: (Jani)
- Fix the comments in intel_fbc_stolen_end
- Use check_sub_overflow
- Remove macro that mirrors SZ_8M, as it is now only referenced once
- Misc. formatting fixes

Fixes: a9da512b3e ("drm/i915: avoid the last 8mb of stolen on BDW/SKL")
Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patch.msgid.link/20260107162935.8123-2-jonathan.cavitt@intel.com
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
(cherry picked from commit 6695dc2798)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-01-26 11:39:57 +02:00
Haoxiang Li
1a8d4c6ecb PCI/MSI: Unmap MSI-X region on error
msix_capability_init() fails to unmap the MSI-X region if
msix_setup_interrupts() fails.

Add the missing iounmap() for that error path.

[ tglx: Massaged change log ]

Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn
2026-01-26 09:46:48 +01:00
Zhang Heng
9e18920e78 ALSA: hda/realtek: Add quirk for Inspur S14-G1
Inspur S14-G1 is equipped with ALC256.
Enable "power saving mode" and Enable "headset jack mode".

Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260126073508.3897461-2-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-01-26 09:41:52 +01:00
Zhang Heng
891b77d459 ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine
The HP EliteBook 630 G11 (103c:8c8f) is using ALC236 codec which used 0x02
to control mute LED and 0x01 to control micmute LED. Therefore, add a quirk
to make it works.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=220828
Cc: <stable@vger.kernel.org>
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260126073508.3897461-1-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-01-26 09:41:35 +01:00
Heinz Mauelshagen
cefcb9297f md raid: fix hang when stopping arrays with metadata through dm-raid
When using device-mapper's dm-raid target, stopping a RAID array can cause
the system to hang under specific conditions.

This occurs when:

- A dm-raid managed device tree is suspended from top to bottom
   (the top-level RAID device is suspended first, followed by its
    underlying metadata and data devices)

- The top-level RAID device is then removed

Removing the top-level device triggers a hang in the following sequence:
the dm-raid destructor calls md_stop(), which tries to flush the
write-intent bitmap by writing to the metadata sub-devices. However, these
devices are already suspended, making them unable to complete the write-intent
operations and causing an indefinite block.

Fix:

- Prevent bitmap flushing when md_stop() is called from dm-raid
destructor context
  and avoid a quiescing/unquescing cycle which could also cause I/O

- Still allow write-intent bitmap flushing when called from dm-raid
suspend context

This ensures that RAID array teardown can complete successfully even when the
underlying devices are in a suspended state.

This second patch uses md_is_rdwr() to distinguish between suspend and
destructor paths as elaborated on above.

Link: https://lore.kernel.org/linux-raid/CAM23VxqYrwkhKEBeQrZeZwQudbiNey2_8B_SEOLqug=pXxaFrA@mail.gmail.com
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
2026-01-26 13:46:40 +08:00
Jiasheng Jiang
f150e753cb md-cluster: fix NULL pointer dereference in process_metadata_update
The function process_metadata_update() blindly dereferences the 'thread'
pointer (acquired via rcu_dereference_protected) within the wait_event()
macro.

While the code comment states "daemon thread must exist", there is a valid
race condition window during the MD array startup sequence (md_run):

1. bitmap_load() is called, which invokes md_cluster_ops->join().
2. join() starts the "cluster_recv" thread (recv_daemon).
3. At this point, recv_daemon is active and processing messages.
4. However, mddev->thread (the main MD thread) is not initialized until
   later in md_run().

If a METADATA_UPDATED message is received from a remote node during this
specific window, process_metadata_update() will be called while
mddev->thread is still NULL, leading to a kernel panic.

To fix this, we must validate the 'thread' pointer. If it is NULL, we
release the held lock (no_new_dev_lockres) and return early, safely
ignoring the update request as the array is not yet fully ready to
process it.

Link: https://lore.kernel.org/linux-raid/20260117145903.28921-1-jiashengjiangcool@gmail.com
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
2026-01-26 13:36:08 +08:00
Jack Wang
46ef85f854 md/bitmap: fix GPF in write_page caused by resize race
A General Protection Fault occurs in write_page() during array resize:
RIP: 0010:write_page+0x22b/0x3c0 [md_mod]

This is a use-after-free race between bitmap_daemon_work() and
__bitmap_resize(). The daemon iterates over `bitmap->storage.filemap`
without locking, while the resize path frees that storage via
md_bitmap_file_unmap(). `quiesce()` does not stop the md thread,
allowing concurrent access to freed pages.

Fix by holding `mddev->bitmap_info.mutex` during the bitmap update.

Link: https://lore.kernel.org/linux-raid/20260120102456.25169-1-jinpu.wang@ionos.com
Closes: https://lore.kernel.org/linux-raid/CAMGffE=Mbfp=7xD_hYxXk1PAaCZNSEAVeQGKGy7YF9f2S4=NEA@mail.gmail.com/T/#u
Cc: stable@vger.kernel.org
Fixes: d60b479d17 ("md/bitmap: add bitmap_resize function to allow bitmap resizing.")
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
2026-01-26 13:36:06 +08:00
Yu Kuai
d119bd2e16 md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout
When llbitmap_suspend_timeout() times out waiting for percpu_ref to
become zero, it returns -ETIMEDOUT without resurrecting the percpu_ref.
The caller (md_llbitmap_daemon_fn) then continues to the next page
without calling llbitmap_resume(), leaving the percpu_ref in a killed
state permanently.

Fix this by resurrecting the percpu_ref before returning the error,
ensuring the page control structure remains usable for subsequent
operations.

Link: https://lore.kernel.org/linux-raid/20260123182623.3718551-3-yukuai@fnnas.com
Fixes: 5ab829f197 ("md/md-llbitmap: introduce new lockless bitmap")
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Li Nan <linan122@huawei.com>
2026-01-26 13:25:31 +08:00
Yu Kuai
cd1635d844 md/raid5: fix IO hang with degraded array with llbitmap
When llbitmap bit state is still unwritten, any new write should force
rcw, as bitmap_ops->blocks_synced() is checked in handle_stripe_dirtying().
However, later the same check is missing in need_this_block(), causing
stripe to deadloop during handling because handle_stripe() will decide
to go to handle_stripe_fill(), meanwhile need_this_block() always return
0 and nothing is handled.

Link: https://lore.kernel.org/linux-raid/20260123182623.3718551-2-yukuai@fnnas.com
Fixes: 5ab829f197 ("md/md-llbitmap: introduce new lockless bitmap")
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Li Nan <linan122@huawei.com>
2026-01-26 13:18:59 +08:00
Li Nan
5d1dd57929 md: remove recovery_disabled
'recovery_disabled' logic is complex and confusing, originally intended to
preserve raid in extreme scenarios. It was used in following cases:
- When sync fails and setting badblocks also fails, kick out non-In_sync
  rdev and block spare rdev from joining to preserve raid [1]
- When last backup is unavailable, prevent repeated add-remove of spares
  triggering recovery [2]

The original issues are now resolved:
- Error handlers in all raid types prevent last rdev from being kicked out
- Disks with failed recovery are marked Faulty and can't re-join

Therefore, remove 'recovery_disabled' as it's no longer needed.

[1] 5389042ffa ("md: change managed of recovery_disabled.")
[2] 4044ba58dd ("md: don't retry recovery of raid1 that fails due to error on source drive.")

Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-13-linan666@huaweicloud.com
Signed-off-by: Li Nan <linan122@huawei.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
2026-01-26 13:17:38 +08:00
Li Nan
7435b73f05 md/raid10: cleanup skip handling in raid10_sync_request
Skip a sector in raid10_sync_request() when it needs no syncing or no
readable device exists. Current skip handling is unnecessary:

- Use 'skip' label to reissue the next sector instead of return directly
- Complete sync and return 'max_sectors' when multiple sectors are skipped
  due to badblocks

The first is error-prone. For example, commit bc49694a9e ("md: pass in
max_sectors for pers->sync_request()") removed redundant max_sector
assignments. Since skip modifies max_sectors, `goto skip` leaves
max_sectors equal to sector_nr after the jump, which is incorrect.

The second causes sync to complete erroneously when no actual sync occurs.
For recovery, recording badblocks and continue syncing subsequent sectors
is more suitable. For resync, just skip bad sectors and syncing subsequent
sectors.

Clean up complex and unnecessary skip code. Return immediately when a
sector should be skipped. Reduce code paths and lower regression risk.

Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-12-linan666@huaweicloud.com
Fixes: bc49694a9e ("md: pass in max_sectors for pers->sync_request()")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
2026-01-26 13:16:26 +08:00
Li Nan
99582edb3f md/raid10: fix any_working flag handling in raid10_sync_request
In raid10_sync_request(), 'any_working' indicates if any IO will
be submitted. When there's only one In_sync disk with badblocks,
'any_working' might be set to 1 but no IO is submitted. Fix it by
setting 'any_working' after badblock checks.

Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-11-linan666@huaweicloud.com
Fixes: e875ecea26 ("md/raid10 record bad blocks as needed during recovery.")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
2026-01-26 13:16:25 +08:00
Li Nan
8ff59a7247 md: move finish_reshape to md_finish_sync()
finish_reshape implementations of raid10 and raid5 only update mddev
and rdev configurations. Move these operations to md_finish_sync() as
it is more appropriate.

No functional changes.

Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-10-linan666@huaweicloud.com
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
2026-01-26 13:16:23 +08:00